WO2013038279A1 - Network-wide flow monitoring in split architecture networks - Google Patents
Network-wide flow monitoring in split architecture networks Download PDFInfo
- Publication number
- WO2013038279A1 WO2013038279A1 PCT/IB2012/054030 IB2012054030W WO2013038279A1 WO 2013038279 A1 WO2013038279 A1 WO 2013038279A1 IB 2012054030 W IB2012054030 W IB 2012054030W WO 2013038279 A1 WO2013038279 A1 WO 2013038279A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- switches
- flows
- switch
- network
- flow
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/026—Capturing of monitoring data using flow identification
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/04—Processing captured monitoring data, e.g. for logfile generation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/12—Network monitoring probes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/20—Arrangements for monitoring or testing data switching networks the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
Definitions
- FIELD Embodiments of the invention relate to the field of split architecture networks; and more specifically, to flow monitoring in split architecture networks.
- Network service providers need to routinely collect flow-level measurements to guide the execution of network management applications.
- the flow information can be used for customer accounting and traffic engineering, which largely rely on aggregate traffic volume statistics.
- flow monitoring is more and more needed for a number of critical network management tasks, such as anomaly detection, identification of unwanted application traffic, and forensic analysis. This analysis needs to identify and analyze as many distinct flows as possible.
- One consequence of this increased complexity is a growing demand for finegrained flow measurements.
- network operators usually do not have prior knowledge of the detailed measurement tasks that the monitoring infrastructure needs to perform.
- security applications For example, a specific network prefix that is "below the radar" for traffic engineering purposes may play an important role in the early detection of anomalies.
- a method, a system and a network element functioning as a controller in a split architecture network are described.
- flow monitoring tasks are assigned to a set of switches in the network to optimize network- wide flow monitoring. The assignment maximizes the number of monitored flows and reduces overhead of the flow monitoring.
- Each of the switches samples flows as directed by the controller, wherein each of the switches samples the flows by monitoring a subset of the flows and recording measurements of the subset of the flows.
- Each of the flows traverses the network via a path defined by one of a set of (Origin, Destination) ("OD") pairs, wherein the Origin is an ingress one of the switches from which the flow enters the network and the Destination is an egress one of the switches from which the flow exits the network.
- OD Olin, Destination
- the method comprises: receiving, by the controller, an input including an estimated traffic volume for each of the paths defined by each of the OD pairs; calculating, for all of the switches and all of the paths, sampling fractions that maximize the number of the flows sampled by the switches.
- the sampling fraction for a given switch and a given path is defined as the number of flows that pass through the given switch and the given path and are sampled by the given switch divided by the total number of the flows that pass through the given path, the calculating being based on the estimated traffic volume and subject to a bandwidth constraint and a memory constraint of the switches; receiving a request to set up a new flow to traverse one of the paths in the network; and assigning the new flow to one of the switches that are located on the one of the paths, based on the sampling fraction for the assigned switch and the one of the paths, the bandwidth constraint and the memory constraint.
- the system comprises: a controller to direct forwarding and sampling of the flows; and a set of switches coupled to the controller via the network.
- the controller comprises memory to store an estimated traffic volume for each of the paths defined by each of the OD pairs; a processor coupled to the memory, the processor adapted to calculate, for all of the switches and all of the paths, sampling fractions that maximize the number of the flows sampled by all of the switches.
- the sampling fraction for a given switch and a given path is defined as the number of flows that passes through the given path and are sampled by the given switch divided by the total number of the flows that pass through the given path, the calculating being based on the estimated traffic volume and subject to a bandwidth constraint and a memory constraint of the switches.
- the controller also comprises a network interface to receive a request to set up a new flow to traverse one of the paths in the network, wherein the request causes the processor to assign the new flow to one of the switches that are located on the one of the paths, based on the sampling fraction for the assigned switch and the one of the paths, the bandwidth constraint and the memory constraint.
- the network element functioning as a controller comprises: memory to store an estimated traffic volume for each of the paths defined by each of the OD pairs; a processor coupled to the memory, the processor adapted to calculate, for all of the switches and all of the paths, sampling fractions that maximize the number of the flows sampled by the switches.
- the sampling fraction for a given switch and a given path is defined as the number of flows that pass through the given switch and the given path and are sampled by the given switch divided by the total number of the flows that pass through the given path, the calculating being based on the estimated traffic volume and subject to a bandwidth constraint and a memory constraint of the switches.
- the network element also comprises a network interface to receive a request to set up a new flow to traverse one of the paths in the network, wherein the request causes the processor to assign the new flow to one of the switches that are located on the one of the paths, based on the sampling fraction for the assigned switch and the one of the paths, the bandwidth constraint and the memory constraint.
- Figure 1 illustrates an embodiment of a split architecture network in which flow monitoring is performed.
- Figure 2 illustrates an embodiment of a controller and a switch in a split architecture network.
- Figure 3 is a flow diagram illustrating an embodiment of a method for network- wide flow monitoring.
- Figure 4 is a flow diagram illustrating an embodiment of a method for optimizing the assignment of flows to the switches associated with a controller.
- Figure 5 is a flow diagram illustrating an embodiment of a method for cross- controller coordination.
- Figure 1 illustrates an embodiment of a split architecture network 100 that includes a number of controllers (e.g., controllers 110 and 120) and a number of switches (e.g., switches 130A-C and 140A-D).
- controllers e.g., controllers 110 and 120
- switches e.g., switches 130A-C and 140A-D.
- Each controller is coupled to a set of switches that are managed by the controller; e.g., the controller 110 is coupled to the switches 130A-C, and the controller 120 is coupled to the switches 140A-D.
- Each controller manages the data packet flows in a predetermined area; e.g., the controller 110 manages the flows in an area 180, and the controller 120 manages the flows in an area 190.
- a split architecture network can include any number of controllers and any number of switches.
- Each controller (110, 120) defines the interconnection and routing among the set of switches that it manages (that is, in the same area 180 as the controller).
- Each controller (110, 120) also handles network state distribution, such as collecting information from the set of switches and distributing routing instructions to the switches.
- Each controller (110, 120) can also be programmed to support new addressing, routing, and complex packet processing applications. That is, the controllers 110 and 120 are the "brain" of the network 100.
- Each switch (130A-C, 140A-D) needs to connect to at least one controller to function correctly.
- the switch 130C when the switch 130C receives a new flow without knowing where to send the packet, the switch 130C forwards the packet to its controller 110. Upon receiving the packet, the controller 110 directs the switch 130C regarding where to forward the new flow. The forwarding rule is then installed on the switch 130C to handle future packets belonging to the same flow.
- a split architecture network such as the split architecture network 100, is a distributed system in which the control plane is decoupled from the forwarding plane.
- the control plane includes a network-wide control platform, such as a small number of controllers (e.g., the controllers 110 and 120).
- the controllers 110 and 120 run on one or more servers in the network 100 and instruct the forwarding behavior of a set of simple, interconnected forwarding elements, such as switches (e.g., the switches 130A-C and 140A-D).
- the decoupling of the control and forwarding planes contrasts to the architecture of a traditional router in which the control plane and the forwarding plane are tightly coupled in the same box.
- the integrated design of the router usually results in overly complicated control plane and complex network management. This complexity of the router creates a high barrier to the development of new protocols and network upgrades. In the traditional network, there is no centralized entity that holds the whole picture of the network.
- FIG 2 illustrates an embodiment of the controller 110 and a switch 130 in the split architecture network 100 of Figure 1. It is understood that other controllers (e.g., the controller 120) and switches (e.g., the switches 130A-C and 140A-D) in the split architecture network 100 can include the same components as the controller 110 and the switch 130, respectively.
- controllers e.g., the controller 120
- switches e.g., the switches 130A-C and 140A-D
- the switch 130 functions as a forwarding element that forwards packets from an ingress port to an egress port, according to the rules in a flow table 252.
- the switch 130 includes a processor 240 coupled to a memory 250, and a set of network interfaces, e.g. 260, for communicating with other network elements (e.g., controllers and switches) in the network 100.
- the memory 250 stores measured flow data 251 and the flow table 252.
- the measured flow data 251 records the measurement of the flows that are monitored and sampled by the switch 130.
- the flow table 252 can be programmed by the processor 240, under the control of the controller 110, to record the rules for forwarding packets from an ingress port to an egress port.
- Each flow entry in the flow table 252 is a rule that contains a set of actions such as forwarding packets to a given port, modifying certain bits in the packet header, encapsulating packets to the controller, or simply dropping the packets.
- the switch 130 can forward the packet to the controller 110 to trigger the programming of a new flow entry into its flow table 252.
- the switch 130 can also forward all of the slow-path packets (such as Internet Control Message protocol (ICMP) packets) to the controller 110 for processing.
- ICMP Internet Control Message protocol
- the controller 110 includes a processor 210 coupled to a memory 220, and a network interface 230 for communicating with other network elements (e.g., controllers and switches) in the network 100.
- the memory 220 stores a traffic matrix 223, switch information 224, routing information 225 and a hash range table 226.
- the traffic matrix 223 stores estimated traffic volume for each of the paths (that is, "each OD pair path" as will be explained below) in the network.
- the traffic matrix contains a set of entries. Each row of the traffic matrix corresponds to an ingress switch, and each column corresponds to an egress switch.
- Each entry in the traffic matrix contains a number (value) representing the number of flows that traverse on a path defined by a corresponding ingress switch in the same row and a corresponding egress switch in the same column.
- the switch information 224 stores memory, bandwidth, and processing information (or constraints) of each of the switches managed by the controller 110.
- the routing information 225 stores the path information among the switches managed by the controller 110. For example, for each ingress switch and egress switch from which a flow enters and exits the network, respectively, the routing information 225 stores a list of the other switches that form a path between the ingress switch and the egress switch. In one embodiment, the routing information 225 also contains information for keeping track of assigned flows for each of the switches managed by the controller 110.
- the hash range table 226 is used in an embodiment where cross-controller coordination is implemented.
- the hash range table 226 stores one or more of hash ranges assigned to the controller 110.
- the controller 110 uses these hash ranges to determine whether it is responsible for handling a given flow.
- the cross-controller coordination will be described in greater detail with reference to Figure 5.
- a flow (also referred to as "packet flow” or “data flow”) of traffic is a set of packets with a common property, known as a flow key, observed within a period of time.
- flow herein can be defined broadly, e.g., data traffic on a Transmission Control Protocol (TCP) connection, or all traffic from a particular Media Access Control (MAC) address or Internet Protocol (IP) address. Switches construct and export summary statistics on packet flows that pass through them.
- the flow key is usually specified by the fields in the packet header, such as the Internet Protocol (IP) source and destination addresses and Transmission Control Protocol (TCP) /User Datagram Protocol (UDP) port numbers.
- IP Internet Protocol
- UDP User Datagram Protocol
- Flows in which the flow key is specified by individual values of these fields are called raw flows, as opposed to aggregate flows in which the flow key is specified by a range of these quantities. Whether a set of packets is to be included in a flow depends on the algorithm used by the controller to assign packets to flows.
- Flow Record A flow record can be created as follows. When a packet arrives at a switch, the switch determines whether the flow is active; that is, whether the statistics are currently being collected for the packet's flow key. If not, the switch instantiates a new set of statistics for the flow key. The statistics include counters for packets and bytes that are updated for each packet matching the flow key.
- a switch can terminate a flow if one of the following criteria is met: (i) inactive flow or inter-packet timeout; that is, the time since the last packet observed for the flow exceeds some threshold; (ii) protocol level information, such as a TCP FIN packet that terminates a TCP connection; (iii) memory management; that is, termination to release memory for new flows; (iv) active flow timeout; that is, to prevent data staleness, flows are terminated after a given elapsed time since the arrival of the first packet of the flow.
- Packet Sampling and Flow Sampling In general, there are two types of sampling methods. With packet sampling, a subset of packets is sampled and the statistics of the sampled packets is collected and measured. With flow sampling, a subset of flows is sampled and the statistics of the sampled flows is collected and measured. Flow sampling preserves the flows intact, as the sampling is performed on the flows (instead of the individual packets within the flows). In practice, any attempt to gather flow statistics involves classifying individual packets into flows. The metadata of all of the packets has to be organized into flows before flow sampling can take place. Thus, flow sampling generally involves more CPU load and more memory than packet sampling.
- packet sampling has an inherent problem of being biased toward large flows. Thus, packet sampling usually results in poor flow coverage. As a result, packet sampling does not satisfy the requirements of many classes of security applications, such as anomaly detection. In addition, this bias increases redundant flow reporting collected by different switches.
- the first option is the one followed by most Internet Service Providers (ISPs) because no automated method exists for the second.
- ISPs Internet Service Providers
- the effect of the first option highly depends on the impact of the sampling method. Given the low sampling rate, the measurement is usually less accurate.
- the first option can only provide simple statistics but not for applications that require higher accuracy.
- Embodiments of the invention use flow sampling because flow sampling is generally better than other solutions in terms of flow coverage and avoidance of bias toward large flows.
- Flow sampling supports a popular set of security applications, such as detecting malware, distributed denial of service (DDoS) attacks, and other malicious attacks.
- flow sampling preserves the accuracy of traffic volume estimation.
- the sampling results can be more suitable for traffic engineering applications.
- the flow sampling technique described herein operates efficiently within switch resource constraints, taking into consideration of the trade-offs between the generality across applications and flow coverage.
- Embodiments of the invention provide a new network-wide flow monitoring approach in a split architecture network with de-coupled control and forwarding planes.
- a split architecture network is the split architecture network 100 of Figure 1.
- Embodiments of the invention are useful for general traffic monitoring in next generation networks deployed with the split architecture. It can also be applied to any network with a centralized controller for routing, such as the Generalized Multi-Protocol Label Switching (GMPLS) networks.
- GPLS Generalized Multi-Protocol Label Switching
- a split architecture network with a centralized controller is able to perform intelligent flow monitoring.
- the centralized controller determines which switch should monitor which types of flow with what sampling rate.
- the use of the centralized controller avoids the independent decision process performed by conventional routers, which record flow measurements completely independently of each other, and, therefore, is the fundamental reason for redundant flow measurements and inefficient use of router resources.
- the centralized controller can run an application that coordinates monitoring responsibilities across different switches. This coordination can significantly increase the coverage and accuracy of network-wide flow monitoring capabilities.
- the flow monitoring technique described herein can operate on an Enterprise network, an Autonomous System (AS), or a mobile backhaul and mobile core transport network.
- the network includes one or more controllers and one or more sets of switches. Each switch has a basic sampling mechanism. The sampled data (which is the collected/ measured statistics) can be sent back to a flow collection server in the network.
- the network-wide flow monitoring technique described herein has the following features:
- Figure 3 illustrates an embodiment of a method 300 for flow monitoring in a split architecture network.
- the method 300 is performed by controllers and switches in a split architecture network, such as the split architecture network 100 of Figure 1.
- the method 300 provides an overview of the operations of the controllers and switches in terms of four stages. Further details of the operations will be described below with reference to Figure 4 and Figure 5.
- a controller calculates sampling fractions (block 310).
- a sampling fraction for a given switch and a given path is defined to be the number of flows that pass through the given switch and the given path and are sampled by the given switch, divided by the total number of the flows that pass through the given switch and the given path.
- the controller performs cross- controller coordination (block 320). The result of the cross-controller coordination indicates whether the controller is responsible for managing the flow. If the controller is responsible for managing the flow, at the third stage, the controller determines which of its switches should be assigned with the task of flow monitoring (block 330).
- the assigned switch measures and records the flow, and sends the recorded flow data to a centralized server (block 340).
- Network-wide optimization To determine which switch should be assigned a flow monitoring task, an optimization framework is used to specify and satisfy network- wide monitoring objectives under the switches' resource constraints. The output of this optimization is stored in the controller as a sampling template.
- the switch informs the controller of the new flow.
- the controller sends a flow entry to the switch, instructing the switching where to forward the flow and whether the switch should sample this flow.
- the flow entry is stored in the switch for a predetermined amount of period to guide the switch with respect to the incoming packets of the same flow.
- the assignment can be modeled as an optimization problem.
- a first input to the optimization problem is an estimated traffic matrix.
- Network operators usually maintain an estimated traffic matrix that records the traffic volume between any pair of ingress and egress switches.
- the rows of the traffic matrix correspond to the ingress switches and the columns correspond to the egress switch.
- Each pair of the ingress/egress combination is known as an Origin-Destination (OD) pair.
- OD Origin-Destination
- Each entry in the traffic matrix is the estimated traffic volume between the corresponding OD pair.
- the estimated traffic volume is represented by the number of flows.
- the entries can be adjusted dynamically by the controller.
- the controller stores the switch level paths between any OD pairs. This information is available in the controller to provide flow entries to each switch. It is assumed that there is only one switch level path between any given OD pair. Further, the controller also stores or receives the resource constraints of each of the switches associated with the controller.
- Pi is defined to be the path (also referred to as "OD path") between an OD-pair ODi (i e [1,N]), and Ti is the number of flows on Pi. N is the total number of OD pairs.
- Each path consists of a set of switches S j , (j e [1,K]).
- Each switch has a maximum resource limit.
- the resource limit can be imposed by the memory constraint as the maximum number of per-flow counters in the memory (e.g., static random access memory (SRAM)), and/or resource limit can be imposed by the bandwidth constraint as the bandwidth for reporting flow records back to a centralized server for storage. Additionally or alternatively, the resource limit can be imposed by the processing constraint of the switch for processing incoming packets.
- the algorithm described herein considers both the memory constraints M j and the bandwidth constrains B j , which correspond to the maximum flow entries that can be stored on switch Si and the number of flows that can be reported per measurement interval, respectively. It is understood that constraints other than M j and B j can also be considered.
- the assignment of monitoring tasks can be modeled as an optimization problem.
- the objective of the optimization is to maximize the total number of flows monitored (i.e., sampled) across all switches, i.e., Max 3 ⁇ 4 (fxTi), assuming that T; is known.
- the optimization is subject to the capacity constraints on each switch.
- the optimization problem is defined below:
- the optimization is subject to five constraints.
- the first constraint ensures that the amount of flow records generated by switch S j in a fix interval does not exceed the amount of bandwidth B j , which is allocated for sending the data back to a centralized server.
- the constant c is the size of the record for each flow in the fixed interval.
- the second constraint indicates that the storage on each switch does not exceed the maximum memory capacity.
- the third constraint is the definition of the total fraction of flows covered, which should be a sum of each switch along the ODi path. Since cfi j is a fraction, it should be a value between 0 and 1. The same constraint applies to f.
- linear programming (LP) techniques can be used to solve the optimization problem to obtain the sampling fractions (di j ) for all i and j.
- Linear programming is commonly known in the field of mathematical programming and, therefore, it is not described herein.
- the controller use the algorithm in Table 1 to instruct which switch should monitor which flow.
- the algorithm aims at balancing the load among the switches. It also ensures that the sets of flow assigned to different switches do not overlap. In other words, each flow will be monitored by one switch along an OD path.
- Figure 4 illustrates an embodiment of a method 400 for optimizing the assignment of flows to the switches associated with a controller.
- the method 400 is performed by a controller, such as controller 110 or 120 of Figure 1.
- the operations of the method 400 correspond to the stage 1 and stage 3 of the method 300 shown in Figure 3.
- Stage 2 of the method 300 can also be performed in an embodiment where cross-controller coordination is implemented.
- a controller receives an input including an estimated traffic volume for each of the paths defined by each of the OD pairs (block 410).
- the controller also has access to the resource constraints at each of its associated (i.e., managed) switches.
- the controller computes sampling fractions to maximize the number of the flows sampled by the switches, wherein a sampling fraction for a given switch and a given path is defined as the number of flows that pass through the given switch and the given path and are sampled by the given switch divided by the total number of the flows that pass through the given path (block 420).
- the calculation is based on the estimated traffic volume and subject to a bandwidth constraint and a memory constraint of the switches.
- the computation of block 420 is performed with linear programming.
- the controller receives a request to set up a new flow to traverse a path in the network (block 430). If the controller is responsible for managing the new flow (e.g., as determined by the cross-controller coordination described with reference to Figure 5), the controller assigns the new flow to one of the switches that are located on the one of the paths, based on the sampling fraction for the assigned switch and the one of the paths, the bandwidth constraint and the memory constraint (block 440). In one embodiment, the switch assignment is based on the algorithm described in Table 1. That is, the controller examines each switch along the OD path to determine whether the switch has reached its sampling fraction, bandwidth constraint and memory constraint. If not, the controller assigned the flow sampling task to that switch. Otherwise, the flow sampling task is assigned to another switch (e.g., the next switch) in the path.
- the controller assigns the new flow to one of the switches that are located on the one of the paths, based on the sampling fraction for the assigned switch and the one of the paths, the bandwidth constraint and the memory constraint (block
- Cross-controller hash-based coordination In one embodiment, a hash-based selection algorithm is used to eliminate duplicate measurements across switches associated with different controllers. This allows switches controlled by different controllers to monitor disjoint sets of flows without requiring explicit communication between the controllers. The hash-based selection algorithm can help eliminate redundant measurements across the network.
- an ISP can operate multiple network areas and some or most of the flows can traverse across multiple areas.
- Table 2 shows an algorithm for the cross-controller coordination. Algorithm 2 Hash Based Assignment Across Controllers
- each controller has a sampling manifest, which is a table of hash ranges indexed with a hash key. One or more of the hash ranges are assigned to each controller. Upon receiving a packet, the controller looks up the hash ranges using a hash key derived from the packet's header fields. It computes the hash of the packet's flow identifier in the header fields. If the hash value falls within the hash range(or ranges) assigned to the controller, the packet (as well as the associated flow) is to be sampled by the switches associated with the controller.
- Hash-based sampling enables a simple and powerful coordination strategy to avoid duplicate measurements among switches under different controllers.
- Controllers are configured to use the same hash function, but are assigned disjoint hash ranges so that the hash of any flow will match at most one controller's hash range. Therefore, the sets of flows sampled by different switches associated with different controllers will not overlap. By assigning non-overlapping hash ranges, cross-controller coordination can be achieved without explicit communication or complex distributed protocols.
- Figure 5 illustrates one embodiment of a method for coordinating the sampling tasks among multiple controllers.
- the method 500 is performed by controllers of a split architecture network, such as controllers 110 and 120 of Figure 1.
- the operations of the method 500 correspond to the stage 2 and stage 3 of the method 300 shown in Figure 3.
- a controller receives a request to set up a new flow to traverse a path in the network (block 510).
- the switch that receives the new flow reports to its controller, and that controller informs all of the other controllers in the network.
- the switch that receives the new flow reports to a centralized server, and that centralized server informs all of the controllers in the network.
- the controller (as well as the other controllers in the network) hashes the flow identifier of the new flow to produce a hash value (block 520). If the hash value falls into the controller's hash range, the controller assigns the new flow to one of the switches that are located on the one of the paths (block 530).
- the switch assignment can be implemented by the method 400 of Figure 4, which is based on the calculated sampling fraction for the assigned switch and the one of the paths, the bandwidth constraint and the memory constraint.
- the controller then updates the routing information stored in the controller to keep track of assigned flows for each of the switches (block 540).
- the controller assigns the new flow to one of its associated switches.
- the assigned switch can then proceed with the operation of block 340 of the method 300 ( Figure 3).
- instructions may refer to specific configurations of hardware such as application specific integrated circuits (ASICs) configured to perform certain operations or having a predetermined functionality or software instructions stored in memory embodied in a non-transitory computer readable medium.
- ASICs application specific integrated circuits
- the techniques shown in the figures can be implemented using code and data stored and executed on one or more electronic devices (e.g., an end station, a network element).
- Such electronic devices store and communicate (internally and/or with other electronic devices over a network) code and data using computer -readable media, such as non- transitory computer-readable storage media (e.g., magnetic disks; optical disks; random access memory; read only memory; flash memory devices; phase-change memory) and transitory computer-readable communication media (e.g., electrical, optical, acoustical or other form of propagated signals - such as carrier waves, infrared signals, digital signals).
- non- transitory computer-readable storage media e.g., magnetic disks; optical disks; random access memory; read only memory; flash memory devices; phase-change memory
- transitory computer-readable communication media e.g., electrical, optical, acoustical or other form of propagated signals - such as carrier waves, infrared signals, digital signals.
- such electronic devices typically include a set of one or more processors coupled to one or more other components, such as one or more storage devices (non-transitory machine-readable storage media), user input/output devices (e.g., a keyboard, a touchscreen, and/or a display), and network connections.
- the coupling of the set of processors and other components is typically through one or more busses and bridges (also termed as bus controllers).
- bus controllers also termed as bus controllers
- the storage device of a given electronic device typically stores code and/or data for execution on the set of one or more processors of that electronic device.
- one or more parts of an embodiment of the invention may be implemented using different combinations of software, firmware, and/or hardware.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Mining & Analysis (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims
Priority Applications (8)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2014530337A JP6013486B2 (en) | 2011-09-14 | 2012-08-07 | Network-wide flow monitoring in split architecture networks |
AU2012310178A AU2012310178B2 (en) | 2011-09-14 | 2012-08-07 | Network-wide flow monitoring in split architecture networks |
KR1020147009475A KR101952985B1 (en) | 2011-09-14 | 2012-08-07 | Network-wide flow monitoring in split architecture networks |
CN201280044801.7A CN103782546B (en) | 2011-09-14 | 2012-08-07 | Split the whole network flow monitoring in architecture network |
CA2848360A CA2848360C (en) | 2011-09-14 | 2012-08-07 | Network-wide flow monitoring in split architecture networks |
BR112014004824-0A BR112014004824B1 (en) | 2011-09-14 | 2012-08-07 | Methods of a network element functioning as a controller for a split architecture network and related systems and network elements |
SG11201400106YA SG11201400106YA (en) | 2011-09-14 | 2012-08-07 | Network-wide flow monitoring in split architecture networks |
EP12769485.9A EP2745468B1 (en) | 2011-09-14 | 2012-08-07 | Network-wide flow monitoring in split architecture networks |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/232,719 | 2011-09-14 | ||
US13/232,719 US8593958B2 (en) | 2011-09-14 | 2011-09-14 | Network-wide flow monitoring in split architecture networks |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2013038279A1 true WO2013038279A1 (en) | 2013-03-21 |
Family
ID=46982655
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/IB2012/054030 WO2013038279A1 (en) | 2011-09-14 | 2012-08-07 | Network-wide flow monitoring in split architecture networks |
Country Status (10)
Country | Link |
---|---|
US (1) | US8593958B2 (en) |
EP (1) | EP2745468B1 (en) |
JP (1) | JP6013486B2 (en) |
KR (1) | KR101952985B1 (en) |
CN (1) | CN103782546B (en) |
AU (1) | AU2012310178B2 (en) |
BR (1) | BR112014004824B1 (en) |
CA (1) | CA2848360C (en) |
SG (1) | SG11201400106YA (en) |
WO (1) | WO2013038279A1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN108391283A (en) * | 2018-06-04 | 2018-08-10 | 于小龙 | A kind of mobile data traffic monitoring system Internet-based |
RU2678167C2 (en) * | 2014-04-02 | 2019-01-23 | Зе Боинг Компани | Requirements for network resources for traffic via multi-stage switching network |
Families Citing this family (42)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2012127894A1 (en) * | 2011-03-18 | 2012-09-27 | 日本電気株式会社 | Network system, and switching method |
US8804490B2 (en) | 2011-07-29 | 2014-08-12 | Telefonaktiebolaget L M Ericsson (Publ) | Controller placement for fast failover in the split architecture |
US9185027B2 (en) * | 2011-07-29 | 2015-11-10 | Telefonaktiebolaget L M Ericsson (Publ) | Method and apparatus for resilient routing of control traffic in a split-architecture system |
US8811212B2 (en) | 2012-02-22 | 2014-08-19 | Telefonaktiebolaget L M Ericsson (Publ) | Controller placement for fast failover in the split architecture |
US9577941B2 (en) * | 2012-02-02 | 2017-02-21 | Nec Corporation | Controller, method for distributing load, non-transitory computer-readable medium storing program, computer system, and control device |
US20150019756A1 (en) * | 2012-02-10 | 2015-01-15 | Nec Corporation | Computer system and virtual network visualization method |
US9425987B2 (en) | 2012-02-10 | 2016-08-23 | Nec Corporation | Computer system and visualization method of virtual network |
US10033644B2 (en) * | 2013-02-12 | 2018-07-24 | Adara Networks, Inc. | Controlling congestion controlled flows |
US9692775B2 (en) * | 2013-04-29 | 2017-06-27 | Telefonaktiebolaget Lm Ericsson (Publ) | Method and system to dynamically detect traffic anomalies in a network |
US9124506B2 (en) | 2013-06-07 | 2015-09-01 | Brocade Communications Systems, Inc. | Techniques for end-to-end network bandwidth optimization using software defined networking |
US9288143B2 (en) * | 2013-10-14 | 2016-03-15 | Hewlett Packard Enterprise Development Lp | Data flow path determination |
US9755942B2 (en) * | 2013-10-25 | 2017-09-05 | Vmware, Inc. | Method and system for monitoring conditions in a dynamic network environment |
US10263903B2 (en) * | 2014-02-05 | 2019-04-16 | Ibasis, Inc. | Method and apparatus for managing communication flow in an inter-network system |
US9629018B2 (en) | 2014-02-05 | 2017-04-18 | Ibasis, Inc. | Method and apparatus for triggering management of communication flow in an inter-network system |
CN104104685B (en) * | 2014-07-23 | 2018-01-02 | 天脉聚源(北京)教育科技有限公司 | A kind of picture retransmission method and device |
EP3175582B1 (en) | 2014-07-28 | 2017-09-06 | Telefonaktiebolaget LM Ericsson (publ) | Automated flow devolvement in an aggregate flow environment |
WO2016044291A1 (en) * | 2014-09-15 | 2016-03-24 | Huawei Technologies Co., Ltd. | System and method for overlapping rate region zoning |
US9608864B2 (en) * | 2014-10-29 | 2017-03-28 | Comcast Cable Communications, Llc | Network control |
KR102063446B1 (en) * | 2014-12-15 | 2020-01-09 | 노키아 솔루션스 앤드 네트웍스 오와이 | Measurement coordination in communications |
US9742648B2 (en) | 2015-03-23 | 2017-08-22 | Brocade Communications Systems, Inc. | Efficient topology failure detection in SDN networks |
US9912536B2 (en) | 2015-04-01 | 2018-03-06 | Brocade Communications Systems LLC | Techniques for facilitating port mirroring in virtual networks |
US9807002B2 (en) | 2015-04-29 | 2017-10-31 | At&T Intellectual Property I, L.P. | Centralized route determination in communication networks |
US9749401B2 (en) | 2015-07-10 | 2017-08-29 | Brocade Communications Systems, Inc. | Intelligent load balancer selection in a multi-load balancer environment |
CN107046504B (en) * | 2016-02-05 | 2020-08-25 | 华为技术有限公司 | Method and controller for traffic engineering in a communication network |
US10469343B2 (en) | 2016-05-04 | 2019-11-05 | Telefonaktiebolaget Lm Ericsson (Publ) | Path continuity determination in an aggregate flow environment |
CN106209493B (en) * | 2016-06-22 | 2019-02-22 | 北京三快在线科技有限公司 | A kind of pair of Internet service system carries out the System and method for of flow tracking |
US10979890B2 (en) | 2016-09-09 | 2021-04-13 | Ibasis, Inc. | Policy control framework |
CN106375160A (en) * | 2016-10-28 | 2017-02-01 | 上海优刻得信息科技有限公司 | Flow monitoring system and flow monitoring method |
CN106357479B (en) * | 2016-11-15 | 2019-08-23 | 中国人民解放军防空兵学院 | A kind of whole network flow monitoring method |
TWI641251B (en) * | 2016-11-18 | 2018-11-11 | 財團法人工業技術研究院 | Method and system for monitoring network flow |
CN108322390B (en) * | 2017-01-18 | 2021-03-09 | 群晖科技股份有限公司 | Router and traffic management method |
US10104000B2 (en) | 2017-01-31 | 2018-10-16 | Hewlett Packard Enterprise Development Lp | Reducing control plane overload of a network device |
CN110036656B (en) | 2017-03-30 | 2022-10-11 | 伊巴西斯公司 | ESIM profile switching without SMS |
US10524116B2 (en) | 2017-06-27 | 2019-12-31 | Ibasis, Inc. | Internet of things services architecture |
CN107508757B (en) * | 2017-08-15 | 2021-11-19 | 网宿科技股份有限公司 | Multi-process load balancing method and device |
US10116671B1 (en) * | 2017-09-28 | 2018-10-30 | International Business Machines Corporation | Distributed denial-of-service attack detection based on shared network flow information |
US11323379B2 (en) * | 2018-10-05 | 2022-05-03 | International Business Machines Corporation | Adaptive monitoring of computing systems |
WO2020121294A1 (en) * | 2018-12-10 | 2020-06-18 | Drivenets Ltd. | A system and a method for monitoring traffic flows in a communications network |
CN110545217B (en) * | 2019-08-30 | 2022-07-05 | 西南交通大学 | Event-driven fine-grained TCP flow measurement method |
US11295253B2 (en) | 2019-12-03 | 2022-04-05 | Copperleaf Technologies Inc. | Method and apparatus for asset management |
US11611494B2 (en) * | 2021-05-07 | 2023-03-21 | Arista Networks, Inc. | Systems and methods for tracking and exporting flows in software with augmented processing in hardware |
CN114500381A (en) * | 2022-01-20 | 2022-05-13 | 北京奇艺世纪科技有限公司 | Network bandwidth limiting method, system, electronic device and readable storage medium |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1672834A1 (en) * | 2004-12-20 | 2006-06-21 | Alcatel | Application session management for flow-based statistics |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN1293478C (en) * | 1999-06-30 | 2007-01-03 | 倾向探测公司 | Method and apparatus for monitoring traffic in a network |
US6842463B1 (en) * | 2000-07-14 | 2005-01-11 | Nortel Networks Limited | Automated and adaptive management of bandwidth capacity in telecommunications networks |
US9338075B2 (en) * | 2009-10-09 | 2016-05-10 | Nec Europe Ltd. | Method for monitoring traffic in a network and a network |
US8817629B2 (en) * | 2010-03-16 | 2014-08-26 | Deutsche Telekom Ag | Method for routing-assisted traffic monitoring |
-
2011
- 2011-09-14 US US13/232,719 patent/US8593958B2/en active Active
-
2012
- 2012-08-07 CN CN201280044801.7A patent/CN103782546B/en active Active
- 2012-08-07 BR BR112014004824-0A patent/BR112014004824B1/en active IP Right Grant
- 2012-08-07 WO PCT/IB2012/054030 patent/WO2013038279A1/en active Application Filing
- 2012-08-07 AU AU2012310178A patent/AU2012310178B2/en not_active Ceased
- 2012-08-07 JP JP2014530337A patent/JP6013486B2/en active Active
- 2012-08-07 CA CA2848360A patent/CA2848360C/en active Active
- 2012-08-07 EP EP12769485.9A patent/EP2745468B1/en active Active
- 2012-08-07 KR KR1020147009475A patent/KR101952985B1/en active IP Right Grant
- 2012-08-07 SG SG11201400106YA patent/SG11201400106YA/en unknown
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1672834A1 (en) * | 2004-12-20 | 2006-06-21 | Alcatel | Application session management for flow-based statistics |
Non-Patent Citations (1)
Title |
---|
SAQIB RAZA ET AL: "MeasuRouting: A Framework for Routing Assisted Traffic Monitoring", INFOCOM, 2010 PROCEEDINGS IEEE, IEEE, PISCATAWAY, NJ, USA, 14 March 2010 (2010-03-14), pages 1 - 9, XP031674806, ISBN: 978-1-4244-5836-3 * |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
RU2678167C2 (en) * | 2014-04-02 | 2019-01-23 | Зе Боинг Компани | Requirements for network resources for traffic via multi-stage switching network |
CN108391283A (en) * | 2018-06-04 | 2018-08-10 | 于小龙 | A kind of mobile data traffic monitoring system Internet-based |
CN108391283B (en) * | 2018-06-04 | 2021-12-10 | 江苏方洋智能科技有限公司 | Mobile phone traffic monitoring system based on Internet |
Also Published As
Publication number | Publication date |
---|---|
AU2012310178A1 (en) | 2014-04-03 |
SG11201400106YA (en) | 2014-03-28 |
KR20140068177A (en) | 2014-06-05 |
CA2848360A1 (en) | 2013-03-21 |
EP2745468B1 (en) | 2015-10-28 |
CN103782546B (en) | 2017-04-05 |
EP2745468A1 (en) | 2014-06-25 |
KR101952985B1 (en) | 2019-02-27 |
JP6013486B2 (en) | 2016-10-25 |
CA2848360C (en) | 2019-08-27 |
CN103782546A (en) | 2014-05-07 |
US20130064079A1 (en) | 2013-03-14 |
BR112014004824B1 (en) | 2022-04-19 |
US8593958B2 (en) | 2013-11-26 |
BR112014004824A2 (en) | 2017-04-04 |
AU2012310178B2 (en) | 2016-05-26 |
JP2014526836A (en) | 2014-10-06 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
AU2012310178B2 (en) | Network-wide flow monitoring in split architecture networks | |
EP2992647B1 (en) | A method and system to dynamically detect traffic anomalies in a network | |
KR101917062B1 (en) | Honeynet method, system and computer program for mitigating link flooding attacks of software defined network | |
Lee et al. | Network monitoring: Present and future | |
US9577906B2 (en) | Scalable performance monitoring using dynamic flow sampling | |
US8130767B2 (en) | Method and apparatus for aggregating network traffic flows | |
US20130304915A1 (en) | Network system, controller, switch and traffic monitoring method | |
Tahaei et al. | A multi-objective software defined network traffic measurement | |
US20170171050A1 (en) | A system and method for integrating legacy flow-monitoring systems with sdn networks | |
US9178794B2 (en) | Communication quality monitoring system, communication quality monitoring method and recording medium | |
JP2007336512A (en) | Statistical information collecting system, and apparatus thereof | |
Suarez-Varela et al. | Flow monitoring in Software-Defined Networks: Finding the accuracy/performance tradeoffs | |
KR20220029142A (en) | Sdn controller server and method for analysing sdn based network traffic usage thereof | |
Jurkiewicz | Boundaries of flow table usage reduction algorithms based on elephant flow detection | |
US20210336960A1 (en) | A System and a Method for Monitoring Traffic Flows in a Communications Network | |
Alssaheli et al. | Software defined network based load balancing for network performance evaluation | |
Abushagur et al. | Hybrid software-defined network monitoring | |
Nacshon et al. | Floware: Balanced flow monitoring in software defined networks | |
Ren et al. | A reactive traffic flow estimation in software defined networks | |
Tan et al. | Flow management mechanism in software-defined network | |
Thien | Fine-Grained and Distributed Traffic Monitoring Platform in Software-Defined Networks | |
Shi et al. | A method for classifying packets into network flows based on ghsom | |
Wu | OpenFlow-enabled dynamic DMZ for local networks | |
Castro et al. | ENDEAVOUR: D3. 1: Monitoring requirements |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 12769485 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2012769485 Country of ref document: EP |
|
ENP | Entry into the national phase |
Ref document number: 2848360 Country of ref document: CA |
|
ENP | Entry into the national phase |
Ref document number: 2014530337 Country of ref document: JP Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 2012310178 Country of ref document: AU Date of ref document: 20120807 Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 20147009475 Country of ref document: KR Kind code of ref document: A |
|
REG | Reference to national code |
Ref country code: BR Ref legal event code: B01A Ref document number: 112014004824 Country of ref document: BR |
|
ENP | Entry into the national phase |
Ref document number: 112014004824 Country of ref document: BR Kind code of ref document: A2 Effective date: 20140227 |